CVE-2026-92536

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5

Description Sensitive information exposure occurs via the get user profile structure function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and registration dates. This is achieved through the Member Directory's per-row user rebinding by using base64 payloads within the [pp-custom-html] shortcode to invoke [profile-email], [profile-username], and [profile-date-registered]. Additionally, if the WordPress users can register option is enabled, unauthenticated attackers can exploit the issue by providing split shortcode fragments through the registration handler via the reg nickname and reg bio fields, which are processed without a nonce requirement. A nonce is a unique token used to prevent replay attacks by ensuring a request is intentional and authentic.

Recommendations Update to version 4.17.5 or later. As a temporary mitigation, disable the users can register option in WordPress to prevent unauthenticated exploitation.